Array parameter decays to a pointer, losing its size
ID |
c.maintainability.array_parameter_decay |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Api Design |
Language |
C / C++ |
Description
This parameter is written as an array, but the language decays it to a plain pointer at the call boundary — sizeof inside the function returns the pointer’s size, not the array’s, and nothing here records how many elements the caller actually passed. Take the size as an explicit parameter, use a pointer type to say what the code really receives, or use a reference-to-array / std::span in C++ to keep the size attached to the type.
Rationale
This parameter is written as an array, but the language decays it to a plain pointer at the call boundary — sizeof inside the function returns the pointer’s size, not the array’s, and nothing here records how many elements the caller actually passed. Take the size as an explicit parameter, use a pointer type to say what the code really receives, or use a reference-to-array / std::span in C++ to keep the size attached to the type.
The following code illustrates the pattern detected by this rule:
// FLAGGED: Array parameter decays to a pointer, losing its size
void process(int items[])
{
items[0] = 1;
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.